Media Library Assistant Unauthenticated Limited File Read Vulnerability

A limited file reading vulnerability has been identified in the Media Library Assistant plugin for WordPress, affecting all versions through 3.29. The issue arises in the 'mla-stream-image.php' file, where unauthenticated attackers can read the contents of arbitrary AI, EPS, PDF, or PS files on the server, potentially exposing sensitive information.

Impact

Exploitation of this vulnerability allows for unauthorized access to the contents of specific file types on the server, which could include sensitive information.

Reproduction

The vulnerability can be reproduced by sending a request to the 'admin-ajax.php' endpoint with the 'mla_stream_file' action. This request must include an encrypted 'mla_item' parameter that specifies the name, ID, and date of a media library item. The 'mla_stream_file' parameter should be set to the file path of a targeted PDF, AI, EPS, or PS file on the server.

Remediation

Users are advised to update the Media Library Assistant plugin to version 3.30 or later.